[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

systemd's journal

On Wed, Feb 12, 2014 at 02:53:39PM +0400, Oleg wrote:
> scp /var/log/syslog ...
> Why do i need an unneeded layer for this - journalctl?

Heh. Maybe we can turn this into a useful question:

Assume that I have a broken system (maybe the disk is partially broken
or it got owned and I don't want to rely on its toolbox anymore). Now
for some reason, I can still access /var/log/journal. Maybe I even have
an offline copy of the FSS[1] keys? So yeah, what I'll be doing is
copying off /var/log/journal from that system before more harm happens.
Unfortunately my recovery system runs sysvinit (not an unlikely scenario
these days). There is no journalctl on that system. So what do I do now?

For the record: If the recovery system does run systemd, you go
journalctl -D /path/to/your/journal/copy.

So for the time being (i.e. until all of my systems and recovery systems
are converted to systemd), I do see a slight[2] disadvantage about using
the journal here. It may take even longer until all initramfs will use
systemd (and I do want to read logs from the initramfs if all I can
mount is the /var/log).


[1] journalctl --setup-keys
[2] I am not trying to capture a full comparison here, but highlighting
    a very specific aspect. If your response includes "but the journal
    is so much better", then you are missing my point.

Reply to: